netdev - Re: [PATCH] bpf: fix size of copy_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <579B0B9F.8040805@iogearbox.net>
Date:	Fri, 29 Jul 2016 09:54:07 +0200
From:	Daniel Borkmann <daniel@...earbox.net>
To:	Alexei Starovoitov <alexei.starovoitov@...il.com>,
	William Tu <u9012063@...il.com>
CC:	netdev@...r.kernel.org
Subject: Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

On 07/29/2016 08:47 AM, Alexei Starovoitov wrote:
> On Thu, Jul 28, 2016 at 05:42:21PM -0700, William Tu wrote:
>> The total size of value copy_to_user() writes to userspace should
>> be the (current number of cpu) * (value size), instead of
>> num_possible_cpus() * (value size).  Found by samples/bpf/test_maps.c,
>> which always copies 512 byte to userspace, crashing the userspace
>> program stack.
>
> hmm. I'm missing something. The sample code assumes no cpu hutplug,
> so sysconf(_SC_NPROCESSORS_CONF) == num_possible_cpu == num_online_cpu,
> unless there is crazy INIT_ALL_POSSIBLE config option is used.

Are you using ARM by chance? What is the count that you get in
user space and from kernel side?

http://lists.infradead.org/pipermail/linux-arm-kernel/2011-June/054177.html